CVE-2018-18206: Denial of Service in Bytom
Summary
CVE-2018-18206: Panic in github.com/bytom/bytom. Affects github.com/bytom/bytom versions < 1.0.4-0.20180831054840-1ac3c8ac4f2b. Fixed in 1.0.4-0.20180831054840-1ac3c8ac4f2b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bytom is an open-source blockchain platform that enables the creation and management of digital assets. It is implemented in Go programming language. Bytom allows users to register topics for communication between peers. However, a vulnerability in the client version prior to 1.0.6 allows for a denial of service attack. The vulnerability exists in the checkTopicRegister function in the p2p/discover/net.go file, which fails to prevent negative idx values. Exploiting this vulnerability can lead to a crash of the Bytom client.
Vulnerability Detail
The vulnerability in Bytom allows an attacker to send malicious input to the checkTopicRegister function, causing it to process negative idx values. This can result in a crash of the Bytom client, leading to a denial of service condition. The impact of this vulnerability is significant as it can disrupt the normal operation of the Bytom blockchain platform.
How To Fix
Latest published version: v1.1.1 as of 23 Oct 2026
go get github.com/bytom/bytom@v1.1.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.4-0.20180831054840-1ac3c8ac4f2b
This is the first release that contains the fix.
go get github.com/bytom/bytom@v1.0.4-0.20180831054840-1ac3c8ac4f2bTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the latest version of Bytom.
Conclusion
The vulnerability in Bytom prior to version 1.0.6 allows for a denial of service attack. Users are advised to upgrade to the latest version to ensure their Bytom client is protected. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/bytom/bytom →
FAQ
Bytom is an open-source blockchain platform that allows for the creation and management of digital assets.
This vulnerability can lead to a denial of service condition, causing the Bytom client to crash and disrupt the normal operation of the platform.
To fix this vulnerability, users should upgrade their Bytom client to version 1.0.6 or later.
No specific workaround is provided for this vulnerability. Upgrading to the latest version is the recommended solution.
For more information about this vulnerability, you can refer to the CVE-2018-18206 advisory or contact the Bytom development team.
